CVE-2024-2948 is a stored cross-site scripting vulnerability in the Favorites WordPress plugin by kylephillips. The issue is due to improper neutralization of input during web page generation, specifically in the 'user_favorites' shortcode where user-supplied attributes like 'no_favorites' are not properly sanitized or escaped. This allows authenticated users with contributor-level privileges or higher to inject arbitrary JavaScript code that executes in the context of other users viewing the affected pages. The vulnerability affects all plugin versions up to and including 2.3.3.

Successful exploitation allows an authenticated contributor or higher to inject persistent malicious scripts into pages, which execute in the browsers of users who access those pages. This can lead to theft of user credentials, session hijacking, or other actions performed with the victim's privileges. The vulnerability does not impact availability but affects confidentiality and integrity to a limited extent as indicated by the CVSS vector (C:L/I:L/A:N).

No official patch or fix is currently confirmed for this vulnerability. Users should check the vendor's advisory or plugin updates regularly for an official fix. Until a patch is available, restrict contributor-level access to trusted users only and consider disabling or removing the Favorites plugin if feasible. Monitor plugin updates closely to apply any forthcoming security patches promptly.